MbamElam.sys bsod and other issues

[Abczec5]

Hi all, would seriously appreciate some help with this!

 

Recently after rebooting my pc, it says that my pc/device needs to be repaired because a critical system driver is missing or contains errors. \windows.old\WINDOWS/system32\DRIVERS\MbamElam.sys

 

I have tried disabling the Elam thing from startup (f8), it gets on windows, but mbam can't start the service, trying it manually from services.msc says (from memory) error 507, something about being unable to validate it. Avast free's UI also doesn't load, but apparently the shields are on. Win Def is on, I remember putting periodic scanning scanning on but not the AV. What could be the problem?

 

When I load windows, it gives me an option for either win 10 or win 10 pro, "pro" is the old version, the one that can't boot, never noticed this before, I can get to login with win 10 normal but haven't tried logging in, idk of this is relevant. I also looked in the driver folder and MbamElam.sys is there, why isn't it starting up?

 

Disabling Elam from startup probably has something to do with the AV/mbam being disabled, but it's the only way I can access win 10 pro. I can get into bootmode.

Recently I have installed a win areo application, a new screensaver, and some skins for classic start menu, as well as a new update. Restore might work here, although even though system protection is on I can't find a backup, although I think there was a one from the 18th with startup repair...

Any help?

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

I'm sorry you're experiencing trouble, but we'll do our best to help.  I suspect this issue may be due to an incompatibility with Avast as recent versions of Malwarebytes have been known to conflict with many third party antivirus applications.  Please start by trying to uninstall Avast using their official uninstall tool located here, then restarting your system, then performing a clean install of Malwarebytes to see if that corrects the issues and allows Malwarebytes to start normally:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Clean button, and allow it to restart your system and then reinstall Malwarebytes, either by allowing the tool to do so when it offers to on restart, or by downloading and installing the latest version from here
   

Please let us know how it goes and whether or not the issues are now corrected.

Thanks

[Abczec5]

Hi,

I restored windows 10 back to 1am this morning, and mbam works again with the service running and set to "automatic" (apparently I can't change it access is denied), and avast free's ui didn't load for a little while but then it finally did, the service works and is also set to "automatic" (can't change again). So the system seems to be working.

Is uninstalling avast/mbam the only way to find out the cause? I was thinking changing one or the other to a delayed start but I can't. Thanks for replying.

[Porthos]

Now since you are up and running,

Can you please collect and upload as an attachment the diagnostic data using our MBST?

• Download and run the Malwarebytes Support Tool
• Accept the EULA and click Advanced tab on the left (not Start Repair)
• Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

Edited December 21, 2020 by Porthos

[Abczec5]

It's still running FRST, it's been on for like 15 mins, when it finishes i'll post back 👍. If it doesn't finish in the next 15 mins, I'll try to collect it again.

[exile360]

27 minutes ago, Abczec5 said:

Is uninstalling avast/mbam the only way to find out the cause? I was thinking changing one or the other to a delayed start but I can't.

Most likely, yes, just because Avast is likely to still load its drivers even when disabled.  Hopefully the issue was just a one time hiccup due to an update or recent change in the system, but please let us know if you encounter any further issues.

[Abczec5]

Here 👍

mbst-grab-results.zip

[Abczec5]

28 minutes ago, exile360 said:

Most likely, yes, just because Avast is likely to still load its drivers even when disabled.  Hopefully the issue was just a one time hiccup due to an update or recent change in the system, but please let us know if you encounter any further issues.

Two other things happened on the system since then from memory, I used cmd to try to bring the sidebar back on the desktop, glary utilities wanted to update to the latest version (haven't done that since I restored), and there may have been a win 10 update. The sidebar thing was the the last thing I done before it went awol, I restarted just after, do you think that you have caused it?

[exile360]

Possibly, but I don't know enough about it to be certain.  It might have been a conflict between Malwarebytes and Avast as was originally suggested which only revealed itself after one of the other changes to the system because of a resulting change in the system's startup timing/boot sequence, but there's no way to really be certain if that's the case.  Just continue to monitor things and if you do encounter any further issues, let us know.

In the meantime, I did make a note of the issue to report to the Product team and I'd also like to get the memory dumps from the crash if I could.  You will find the two memory dump files listed below:

C:\WINDOWS\Minidump\122020-42812-01.dmp
C:\WINDOWS\MEMORY.DMP

Please copy both files to your desktop, then select both of them and right-click on them and hover your mouse over Send to and select Compressed (zipped) folder then upload the resulting ZIP file to WeTransfer.com, making sure to click on the circular ... button and selecting the option Get transfer link and post back the link it provides once the file has been uploaded as the file will likely be too large to attach here on the forums.

One additional note; I also noticed that you have NordVPN installed, and recently Malwarebytes has had some compatibility issues with some third party VPN applications as well because they sometimes conflict with Malwarebytes' Web Protection component so you might also try uninstalling Nord if you do experience the issue again to see if that helps.

[Abczec5]

https://we.tl/t-0N7zFUjq0P

 

Here are the files... 👍

[exile360]

Excellent, thank you.

[Abczec5]

50 minutes ago, exile360 said:

One additional note; I also noticed that you have NordVPN installed, and recently Malwarebytes has had some compatibility issues with some third party VPN applications as well because they sometimes conflict with Malwarebytes' Web Protection component so you might also try uninstalling Nord if you do experience the issue again to see if that helps.

Okay, I'll keep that in mind too.

[Abczec5]

Any ideas of what the cause was? Haven't restarted yet.

[exile360]

Avast and Nord are still at the top of my list for suspects.  It might simply be that one of the products or even Malwarebytes itself updated too before you restarted, and once you rebooted, the issue emerged due to the new version.  As I mentioned earlier, we have seen issues with Avast recently, so I'm still leaning that way.

If you're using Glary to delay/manipulate the startup/timing of any of the security apps that could also be a factor, but seems less likely.  Dev/QA will likely analyze the memory dumps when they get the chance, but for now just make sure you have created a new restore point in case any more issues to show up so that you can roll back if needed without losing too many of your programs/changes you've made since then to the system.  You'll find instructions on how to create a restore point in this Microsoft support article if you need it.

[exile360]

By the way, while I'm no expert when it comes to analyzing memory dumps, the error indicated is DRIVER_POWER_STATE_FAILURE but doesn't seem to indicate which specific driver caused it (at least as far as I can see using BlueScreenView) and based on my research, that particular error has to do with a driver failing to respond in time to a power state change (such as shutting down or waking from sleep etc.) so it seems that it may be due to the one of the drivers not starting up/powering up in a timely manner during the boot process.  I suspect that could be due to a conflict between two of the drivers, resulting in that driver failing to load on boot and resulting in the BSOD, which would also explain why it showed that initial error about the driver being missing (assuming it was referring to the driver being expected to be in memory during startup and failing to load).

Please keep in mind that this is just my hypothesis; again, I'm no expert on the subject, but if there is some kind of bug or conflict, those memory dumps should help the QA and Dev teams to track it down.

In the meantime, as I mentioned, just be sure you have a fresh restore point created just in case, and monitor to see if any further issues occur.

You can also try to reduce the chances of any potential conflicts by configuring exclusions between the security apps.  To do so, add the items listed in this support article to Avast's trusted/allowed/ignore list, particularly for its real-time protection components, and add Avast's main program folder (likely under C:\Program Files and/or C:\Program Files (x86)) to Malwarebytes' Allow List using the method described under the Allow a file or folder section of this support article and do the same for its primary data folder which is likely located under C:\ProgramData (you can enter that path into the address bar in Explorer if you don't see it, or you can configure Windows to show hidden files and folders as described in this Microsoft support article and an illustrated guide on how to do so can be found here).

[Abczec5]

11 hours ago, exile360 said:

Avast and Nord are still at the top of my list for suspects.  It might simply be that one of the products or even Malwarebytes itself updated too before you restarted, and once you rebooted, the issue emerged due to the new version.  As I mentioned earlier, we have seen issues with Avast recently, so I'm still leaning that way.

If you're using Glary to delay/manipulate the startup/timing of any of the security apps that could also be a factor, but seems less likely.  Dev/QA will likely analyze the memory dumps when they get the chance, but for now just make sure you have created a new restore point in case any more issues to show up so that you can roll back if needed without losing too many of your programs/changes you've made since then to the system.  You'll find instructions on how to create a restore point in this Microsoft support article if you need it.

I added exlusions based on recommendations online to avast and mbam, I can for nord as well think I will find them somewhere online.

[0xFFFF]

From your latest dump file, the issue appears to be video-card driver, I would suggest checking for a potential update.

[AdvancedSetup]

Hello @Abczec5

Following up to see if you were able to update your video drivers as mentioned by @0xFFFF

Please post a status update when you have a moment

Thank you